Manuel Pégourié-Gonnard | 2aea141 | 2013-01-26 16:33:44 +0100 | [diff] [blame] | 1 | /* |
| 2 | * Elliptic curve DSA |
| 3 | * |
| 4 | * Copyright (C) 2006-2013, Brainspark B.V. |
| 5 | * |
| 6 | * This file is part of PolarSSL (http://www.polarssl.org) |
| 7 | * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org> |
| 8 | * |
| 9 | * All rights reserved. |
| 10 | * |
| 11 | * This program is free software; you can redistribute it and/or modify |
| 12 | * it under the terms of the GNU General Public License as published by |
| 13 | * the Free Software Foundation; either version 2 of the License, or |
| 14 | * (at your option) any later version. |
| 15 | * |
| 16 | * This program is distributed in the hope that it will be useful, |
| 17 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 18 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 19 | * GNU General Public License for more details. |
| 20 | * |
| 21 | * You should have received a copy of the GNU General Public License along |
| 22 | * with this program; if not, write to the Free Software Foundation, Inc., |
| 23 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
| 24 | */ |
| 25 | |
| 26 | /* |
| 27 | * References: |
| 28 | * |
| 29 | * SEC1 http://www.secg.org/index.php?action=secg,docs_secg |
| 30 | */ |
| 31 | |
| 32 | #include "polarssl/config.h" |
| 33 | |
| 34 | #if defined(POLARSSL_ECDSA_C) |
| 35 | |
| 36 | #include "polarssl/ecdsa.h" |
Manuel Pégourié-Gonnard | b694b48 | 2013-08-08 13:30:57 +0200 | [diff] [blame] | 37 | #include "polarssl/asn1write.h" |
Manuel Pégourié-Gonnard | 2aea141 | 2013-01-26 16:33:44 +0100 | [diff] [blame] | 38 | |
Manuel Pégourié-Gonnard | 461d416 | 2014-01-06 10:16:28 +0100 | [diff] [blame] | 39 | #if defined(POLARSSL_ECDSA_DETERMINISTIC) |
Manuel Pégourié-Gonnard | 7845fc0 | 2014-01-27 14:24:03 +0100 | [diff] [blame] | 40 | #include "polarssl/hmac_drbg.h" |
| 41 | #endif |
Manuel Pégourié-Gonnard | 461d416 | 2014-01-06 10:16:28 +0100 | [diff] [blame] | 42 | |
Manuel Pégourié-Gonnard | 7845fc0 | 2014-01-27 14:24:03 +0100 | [diff] [blame] | 43 | #if defined(POLARSSL_ECDSA_DETERMINISTIC) |
Manuel Pégourié-Gonnard | 5e6edcf | 2014-01-07 16:17:53 +0100 | [diff] [blame] | 44 | /* |
| 45 | * This a hopefully temporary compatibility function. |
| 46 | * |
| 47 | * Since we can't ensure the caller will pass a valid md_alg before the next |
| 48 | * interface change, try to pick up a decent md by size. |
| 49 | * |
| 50 | * Argument is the minimum size in bytes of the MD output. |
| 51 | */ |
Manuel Pégourié-Gonnard | 9592485 | 2014-03-21 10:54:55 +0100 | [diff] [blame] | 52 | static const md_info_t *md_info_by_size( size_t min_size ) |
Manuel Pégourié-Gonnard | 5e6edcf | 2014-01-07 16:17:53 +0100 | [diff] [blame] | 53 | { |
| 54 | const md_info_t *md_cur, *md_picked = NULL; |
| 55 | const int *md_alg; |
| 56 | |
| 57 | for( md_alg = md_list(); *md_alg != 0; md_alg++ ) |
| 58 | { |
| 59 | if( ( md_cur = md_info_from_type( *md_alg ) ) == NULL || |
Manuel Pégourié-Gonnard | 9592485 | 2014-03-21 10:54:55 +0100 | [diff] [blame] | 60 | (size_t) md_cur->size < min_size || |
Manuel Pégourié-Gonnard | 5e6edcf | 2014-01-07 16:17:53 +0100 | [diff] [blame] | 61 | ( md_picked != NULL && md_cur->size > md_picked->size ) ) |
| 62 | continue; |
| 63 | |
| 64 | md_picked = md_cur; |
| 65 | } |
| 66 | |
| 67 | return( md_picked ); |
| 68 | } |
Manuel Pégourié-Gonnard | 461d416 | 2014-01-06 10:16:28 +0100 | [diff] [blame] | 69 | #endif |
| 70 | |
Manuel Pégourié-Gonnard | b309ab2 | 2013-01-26 17:24:59 +0100 | [diff] [blame] | 71 | /* |
Manuel Pégourié-Gonnard | 3aeb5a7 | 2013-01-26 18:05:50 +0100 | [diff] [blame] | 72 | * Derive a suitable integer for group grp from a buffer of length len |
| 73 | * SEC1 4.1.3 step 5 aka SEC1 4.1.4 step 3 |
| 74 | */ |
| 75 | static int derive_mpi( const ecp_group *grp, mpi *x, |
| 76 | const unsigned char *buf, size_t blen ) |
| 77 | { |
Manuel Pégourié-Gonnard | 5304812 | 2014-01-03 12:55:15 +0100 | [diff] [blame] | 78 | int ret; |
Manuel Pégourié-Gonnard | 3aeb5a7 | 2013-01-26 18:05:50 +0100 | [diff] [blame] | 79 | size_t n_size = (grp->nbits + 7) / 8; |
Manuel Pégourié-Gonnard | 5304812 | 2014-01-03 12:55:15 +0100 | [diff] [blame] | 80 | size_t use_size = blen > n_size ? n_size : blen; |
| 81 | |
| 82 | MPI_CHK( mpi_read_binary( x, buf, use_size ) ); |
| 83 | if( use_size * 8 > grp->nbits ) |
| 84 | MPI_CHK( mpi_shift_r( x, use_size * 8 - grp->nbits ) ); |
| 85 | |
Manuel Pégourié-Gonnard | 461d416 | 2014-01-06 10:16:28 +0100 | [diff] [blame] | 86 | /* While at it, reduce modulo N */ |
| 87 | if( mpi_cmp_mpi( x, &grp->N ) >= 0 ) |
| 88 | MPI_CHK( mpi_sub_mpi( x, x, &grp->N ) ); |
| 89 | |
Manuel Pégourié-Gonnard | 5304812 | 2014-01-03 12:55:15 +0100 | [diff] [blame] | 90 | cleanup: |
| 91 | return( ret ); |
Manuel Pégourié-Gonnard | 3aeb5a7 | 2013-01-26 18:05:50 +0100 | [diff] [blame] | 92 | } |
| 93 | |
| 94 | /* |
Manuel Pégourié-Gonnard | b309ab2 | 2013-01-26 17:24:59 +0100 | [diff] [blame] | 95 | * Compute ECDSA signature of a hashed message (SEC1 4.1.3) |
| 96 | * Obviously, compared to SEC1 4.1.3, we skip step 4 (hash message) |
| 97 | */ |
Manuel Pégourié-Gonnard | 161ef96 | 2013-09-17 19:13:10 +0200 | [diff] [blame] | 98 | int ecdsa_sign( ecp_group *grp, mpi *r, mpi *s, |
Manuel Pégourié-Gonnard | b309ab2 | 2013-01-26 17:24:59 +0100 | [diff] [blame] | 99 | const mpi *d, const unsigned char *buf, size_t blen, |
| 100 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ) |
| 101 | { |
Manuel Pégourié-Gonnard | dd75c31 | 2014-03-31 11:55:42 +0200 | [diff] [blame] | 102 | int ret, key_tries, sign_tries, blind_tries; |
Manuel Pégourié-Gonnard | b309ab2 | 2013-01-26 17:24:59 +0100 | [diff] [blame] | 103 | ecp_point R; |
Manuel Pégourié-Gonnard | dd75c31 | 2014-03-31 11:55:42 +0200 | [diff] [blame] | 104 | mpi k, e, t; |
Manuel Pégourié-Gonnard | b309ab2 | 2013-01-26 17:24:59 +0100 | [diff] [blame] | 105 | |
Manuel Pégourié-Gonnard | 97871ef | 2013-12-04 20:52:04 +0100 | [diff] [blame] | 106 | /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */ |
| 107 | if( grp->N.p == NULL ) |
| 108 | return( POLARSSL_ERR_ECP_BAD_INPUT_DATA ); |
| 109 | |
Manuel Pégourié-Gonnard | b309ab2 | 2013-01-26 17:24:59 +0100 | [diff] [blame] | 110 | ecp_point_init( &R ); |
Manuel Pégourié-Gonnard | dd75c31 | 2014-03-31 11:55:42 +0200 | [diff] [blame] | 111 | mpi_init( &k ); mpi_init( &e ); mpi_init( &t ); |
Manuel Pégourié-Gonnard | b309ab2 | 2013-01-26 17:24:59 +0100 | [diff] [blame] | 112 | |
| 113 | sign_tries = 0; |
| 114 | do |
| 115 | { |
| 116 | /* |
| 117 | * Steps 1-3: generate a suitable ephemeral keypair |
Manuel Pégourié-Gonnard | 178d9ba | 2013-10-29 10:45:28 +0100 | [diff] [blame] | 118 | * and set r = xR mod n |
Manuel Pégourié-Gonnard | b309ab2 | 2013-01-26 17:24:59 +0100 | [diff] [blame] | 119 | */ |
| 120 | key_tries = 0; |
| 121 | do |
| 122 | { |
| 123 | MPI_CHK( ecp_gen_keypair( grp, &k, &R, f_rng, p_rng ) ); |
Manuel Pégourié-Gonnard | 178d9ba | 2013-10-29 10:45:28 +0100 | [diff] [blame] | 124 | MPI_CHK( mpi_mod_mpi( r, &R.X, &grp->N ) ); |
Manuel Pégourié-Gonnard | b309ab2 | 2013-01-26 17:24:59 +0100 | [diff] [blame] | 125 | |
| 126 | if( key_tries++ > 10 ) |
Paul Bakker | cca998a | 2013-07-26 14:20:53 +0200 | [diff] [blame] | 127 | { |
Manuel Pégourié-Gonnard | 456d3b9 | 2013-09-16 18:04:38 +0200 | [diff] [blame] | 128 | ret = POLARSSL_ERR_ECP_RANDOM_FAILED; |
Paul Bakker | cca998a | 2013-07-26 14:20:53 +0200 | [diff] [blame] | 129 | goto cleanup; |
| 130 | } |
Manuel Pégourié-Gonnard | b309ab2 | 2013-01-26 17:24:59 +0100 | [diff] [blame] | 131 | } |
| 132 | while( mpi_cmp_int( r, 0 ) == 0 ); |
| 133 | |
| 134 | /* |
| 135 | * Step 5: derive MPI from hashed message |
| 136 | */ |
Manuel Pégourié-Gonnard | 3aeb5a7 | 2013-01-26 18:05:50 +0100 | [diff] [blame] | 137 | MPI_CHK( derive_mpi( grp, &e, buf, blen ) ); |
Manuel Pégourié-Gonnard | b309ab2 | 2013-01-26 17:24:59 +0100 | [diff] [blame] | 138 | |
| 139 | /* |
Manuel Pégourié-Gonnard | dd75c31 | 2014-03-31 11:55:42 +0200 | [diff] [blame] | 140 | * Generate a random value to blind inv_mod in next step, |
| 141 | * avoiding a potential timing leak. |
| 142 | */ |
| 143 | blind_tries = 0; |
| 144 | do |
| 145 | { |
| 146 | size_t n_size = (grp->nbits + 7) / 8; |
| 147 | MPI_CHK( mpi_fill_random( &t, n_size, f_rng, p_rng ) ); |
| 148 | MPI_CHK( mpi_shift_r( &t, 8 * n_size - grp->nbits ) ); |
| 149 | |
| 150 | /* See ecp_gen_keypair() */ |
| 151 | if( ++blind_tries > 30 ) |
| 152 | return( POLARSSL_ERR_ECP_RANDOM_FAILED ); |
| 153 | } |
| 154 | while( mpi_cmp_int( &t, 1 ) < 0 || |
| 155 | mpi_cmp_mpi( &t, &grp->N ) >= 0 ); |
| 156 | |
| 157 | /* |
| 158 | * Step 6: compute s = (e + r * d) / k = t (e + rd) / (kt) mod n |
Manuel Pégourié-Gonnard | b309ab2 | 2013-01-26 17:24:59 +0100 | [diff] [blame] | 159 | */ |
| 160 | MPI_CHK( mpi_mul_mpi( s, r, d ) ); |
| 161 | MPI_CHK( mpi_add_mpi( &e, &e, s ) ); |
Manuel Pégourié-Gonnard | dd75c31 | 2014-03-31 11:55:42 +0200 | [diff] [blame] | 162 | MPI_CHK( mpi_mul_mpi( &e, &e, &t ) ); |
| 163 | MPI_CHK( mpi_mul_mpi( &k, &k, &t ) ); |
Manuel Pégourié-Gonnard | b309ab2 | 2013-01-26 17:24:59 +0100 | [diff] [blame] | 164 | MPI_CHK( mpi_inv_mod( s, &k, &grp->N ) ); |
| 165 | MPI_CHK( mpi_mul_mpi( s, s, &e ) ); |
| 166 | MPI_CHK( mpi_mod_mpi( s, s, &grp->N ) ); |
| 167 | |
| 168 | if( sign_tries++ > 10 ) |
Paul Bakker | cca998a | 2013-07-26 14:20:53 +0200 | [diff] [blame] | 169 | { |
Manuel Pégourié-Gonnard | 456d3b9 | 2013-09-16 18:04:38 +0200 | [diff] [blame] | 170 | ret = POLARSSL_ERR_ECP_RANDOM_FAILED; |
Paul Bakker | cca998a | 2013-07-26 14:20:53 +0200 | [diff] [blame] | 171 | goto cleanup; |
| 172 | } |
Manuel Pégourié-Gonnard | b309ab2 | 2013-01-26 17:24:59 +0100 | [diff] [blame] | 173 | } |
| 174 | while( mpi_cmp_int( s, 0 ) == 0 ); |
| 175 | |
| 176 | cleanup: |
| 177 | ecp_point_free( &R ); |
Manuel Pégourié-Gonnard | dd75c31 | 2014-03-31 11:55:42 +0200 | [diff] [blame] | 178 | mpi_free( &k ); mpi_free( &e ); mpi_free( &t ); |
Manuel Pégourié-Gonnard | b309ab2 | 2013-01-26 17:24:59 +0100 | [diff] [blame] | 179 | |
| 180 | return( ret ); |
| 181 | } |
Manuel Pégourié-Gonnard | 2aea141 | 2013-01-26 16:33:44 +0100 | [diff] [blame] | 182 | |
Manuel Pégourié-Gonnard | 4daaef7 | 2014-01-06 14:25:56 +0100 | [diff] [blame] | 183 | #if defined(POLARSSL_ECDSA_DETERMINISTIC) |
| 184 | /* |
| 185 | * Deterministic signature wrapper |
| 186 | */ |
| 187 | int ecdsa_sign_det( ecp_group *grp, mpi *r, mpi *s, |
| 188 | const mpi *d, const unsigned char *buf, size_t blen, |
| 189 | md_type_t md_alg ) |
| 190 | { |
| 191 | int ret; |
| 192 | hmac_drbg_context rng_ctx; |
Manuel Pégourié-Gonnard | f42bca6 | 2014-01-06 15:05:01 +0100 | [diff] [blame] | 193 | unsigned char data[2 * POLARSSL_ECP_MAX_BYTES]; |
Manuel Pégourié-Gonnard | 4daaef7 | 2014-01-06 14:25:56 +0100 | [diff] [blame] | 194 | size_t grp_len = ( grp->nbits + 7 ) / 8; |
| 195 | const md_info_t *md_info; |
| 196 | mpi h; |
| 197 | |
Manuel Pégourié-Gonnard | 5e6edcf | 2014-01-07 16:17:53 +0100 | [diff] [blame] | 198 | /* Temporary fallback */ |
| 199 | if( md_alg == POLARSSL_MD_NONE ) |
| 200 | md_info = md_info_by_size( blen ); |
| 201 | else |
| 202 | md_info = md_info_from_type( md_alg ); |
| 203 | |
| 204 | if( md_info == NULL ) |
Manuel Pégourié-Gonnard | 4daaef7 | 2014-01-06 14:25:56 +0100 | [diff] [blame] | 205 | return( POLARSSL_ERR_ECP_BAD_INPUT_DATA ); |
| 206 | |
| 207 | mpi_init( &h ); |
| 208 | memset( &rng_ctx, 0, sizeof( hmac_drbg_context ) ); |
| 209 | |
Manuel Pégourié-Gonnard | f42bca6 | 2014-01-06 15:05:01 +0100 | [diff] [blame] | 210 | /* Use private key and message hash (reduced) to initialize HMAC_DRBG */ |
| 211 | MPI_CHK( mpi_write_binary( d, data, grp_len ) ); |
Manuel Pégourié-Gonnard | 4daaef7 | 2014-01-06 14:25:56 +0100 | [diff] [blame] | 212 | MPI_CHK( derive_mpi( grp, &h, buf, blen ) ); |
Manuel Pégourié-Gonnard | f42bca6 | 2014-01-06 15:05:01 +0100 | [diff] [blame] | 213 | MPI_CHK( mpi_write_binary( &h, data + grp_len, grp_len ) ); |
Manuel Pégourié-Gonnard | fe34a5f | 2014-01-30 15:06:40 +0100 | [diff] [blame] | 214 | hmac_drbg_init_buf( &rng_ctx, md_info, data, 2 * grp_len ); |
Manuel Pégourié-Gonnard | 4daaef7 | 2014-01-06 14:25:56 +0100 | [diff] [blame] | 215 | |
Manuel Pégourié-Gonnard | 4daaef7 | 2014-01-06 14:25:56 +0100 | [diff] [blame] | 216 | ret = ecdsa_sign( grp, r, s, d, buf, blen, |
| 217 | hmac_drbg_random, &rng_ctx ); |
| 218 | |
| 219 | cleanup: |
| 220 | hmac_drbg_free( &rng_ctx ); |
| 221 | mpi_free( &h ); |
| 222 | |
| 223 | return( ret ); |
| 224 | } |
Paul Bakker | 9f3c7d7 | 2014-01-23 16:11:14 +0100 | [diff] [blame] | 225 | #endif /* POLARSSL_ECDSA_DETERMINISTIC */ |
| 226 | |
Manuel Pégourié-Gonnard | 3aeb5a7 | 2013-01-26 18:05:50 +0100 | [diff] [blame] | 227 | /* |
| 228 | * Verify ECDSA signature of hashed message (SEC1 4.1.4) |
| 229 | * Obviously, compared to SEC1 4.1.3, we skip step 2 (hash message) |
| 230 | */ |
Manuel Pégourié-Gonnard | 161ef96 | 2013-09-17 19:13:10 +0200 | [diff] [blame] | 231 | int ecdsa_verify( ecp_group *grp, |
Manuel Pégourié-Gonnard | 3aeb5a7 | 2013-01-26 18:05:50 +0100 | [diff] [blame] | 232 | const unsigned char *buf, size_t blen, |
| 233 | const ecp_point *Q, const mpi *r, const mpi *s) |
| 234 | { |
| 235 | int ret; |
| 236 | mpi e, s_inv, u1, u2; |
| 237 | ecp_point R, P; |
| 238 | |
| 239 | ecp_point_init( &R ); ecp_point_init( &P ); |
| 240 | mpi_init( &e ); mpi_init( &s_inv ); mpi_init( &u1 ); mpi_init( &u2 ); |
| 241 | |
Manuel Pégourié-Gonnard | 97871ef | 2013-12-04 20:52:04 +0100 | [diff] [blame] | 242 | /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */ |
| 243 | if( grp->N.p == NULL ) |
| 244 | return( POLARSSL_ERR_ECP_BAD_INPUT_DATA ); |
| 245 | |
Manuel Pégourié-Gonnard | 3aeb5a7 | 2013-01-26 18:05:50 +0100 | [diff] [blame] | 246 | /* |
| 247 | * Step 1: make sure r and s are in range 1..n-1 |
| 248 | */ |
| 249 | if( mpi_cmp_int( r, 1 ) < 0 || mpi_cmp_mpi( r, &grp->N ) >= 0 || |
| 250 | mpi_cmp_int( s, 1 ) < 0 || mpi_cmp_mpi( s, &grp->N ) >= 0 ) |
| 251 | { |
Manuel Pégourié-Gonnard | db77175 | 2013-08-27 15:11:23 +0200 | [diff] [blame] | 252 | ret = POLARSSL_ERR_ECP_VERIFY_FAILED; |
Paul Bakker | cca998a | 2013-07-26 14:20:53 +0200 | [diff] [blame] | 253 | goto cleanup; |
Manuel Pégourié-Gonnard | 3aeb5a7 | 2013-01-26 18:05:50 +0100 | [diff] [blame] | 254 | } |
| 255 | |
| 256 | /* |
| 257 | * Additional precaution: make sure Q is valid |
| 258 | */ |
| 259 | MPI_CHK( ecp_check_pubkey( grp, Q ) ); |
| 260 | |
| 261 | /* |
| 262 | * Step 3: derive MPI from hashed message |
| 263 | */ |
| 264 | MPI_CHK( derive_mpi( grp, &e, buf, blen ) ); |
| 265 | |
| 266 | /* |
| 267 | * Step 4: u1 = e / s mod n, u2 = r / s mod n |
| 268 | */ |
| 269 | MPI_CHK( mpi_inv_mod( &s_inv, s, &grp->N ) ); |
| 270 | |
| 271 | MPI_CHK( mpi_mul_mpi( &u1, &e, &s_inv ) ); |
| 272 | MPI_CHK( mpi_mod_mpi( &u1, &u1, &grp->N ) ); |
| 273 | |
| 274 | MPI_CHK( mpi_mul_mpi( &u2, r, &s_inv ) ); |
| 275 | MPI_CHK( mpi_mod_mpi( &u2, &u2, &grp->N ) ); |
| 276 | |
| 277 | /* |
| 278 | * Step 5: R = u1 G + u2 Q |
Manuel Pégourié-Gonnard | e09d2f8 | 2013-09-02 14:29:09 +0200 | [diff] [blame] | 279 | * |
| 280 | * Since we're not using any secret data, no need to pass a RNG to |
| 281 | * ecp_mul() for countermesures. |
Manuel Pégourié-Gonnard | 3aeb5a7 | 2013-01-26 18:05:50 +0100 | [diff] [blame] | 282 | */ |
Manuel Pégourié-Gonnard | e09d2f8 | 2013-09-02 14:29:09 +0200 | [diff] [blame] | 283 | MPI_CHK( ecp_mul( grp, &R, &u1, &grp->G, NULL, NULL ) ); |
| 284 | MPI_CHK( ecp_mul( grp, &P, &u2, Q, NULL, NULL ) ); |
Manuel Pégourié-Gonnard | 3aeb5a7 | 2013-01-26 18:05:50 +0100 | [diff] [blame] | 285 | MPI_CHK( ecp_add( grp, &R, &R, &P ) ); |
| 286 | |
| 287 | if( ecp_is_zero( &R ) ) |
Paul Bakker | cca998a | 2013-07-26 14:20:53 +0200 | [diff] [blame] | 288 | { |
Manuel Pégourié-Gonnard | db77175 | 2013-08-27 15:11:23 +0200 | [diff] [blame] | 289 | ret = POLARSSL_ERR_ECP_VERIFY_FAILED; |
Paul Bakker | cca998a | 2013-07-26 14:20:53 +0200 | [diff] [blame] | 290 | goto cleanup; |
| 291 | } |
Manuel Pégourié-Gonnard | 3aeb5a7 | 2013-01-26 18:05:50 +0100 | [diff] [blame] | 292 | |
| 293 | /* |
Manuel Pégourié-Gonnard | 178d9ba | 2013-10-29 10:45:28 +0100 | [diff] [blame] | 294 | * Step 6: convert xR to an integer (no-op) |
| 295 | * Step 7: reduce xR mod n (gives v) |
| 296 | */ |
| 297 | MPI_CHK( mpi_mod_mpi( &R.X, &R.X, &grp->N ) ); |
| 298 | |
| 299 | /* |
| 300 | * Step 8: check if v (that is, R.X) is equal to r |
Manuel Pégourié-Gonnard | 3aeb5a7 | 2013-01-26 18:05:50 +0100 | [diff] [blame] | 301 | */ |
| 302 | if( mpi_cmp_mpi( &R.X, r ) != 0 ) |
Paul Bakker | cca998a | 2013-07-26 14:20:53 +0200 | [diff] [blame] | 303 | { |
Manuel Pégourié-Gonnard | db77175 | 2013-08-27 15:11:23 +0200 | [diff] [blame] | 304 | ret = POLARSSL_ERR_ECP_VERIFY_FAILED; |
Paul Bakker | cca998a | 2013-07-26 14:20:53 +0200 | [diff] [blame] | 305 | goto cleanup; |
| 306 | } |
Manuel Pégourié-Gonnard | 3aeb5a7 | 2013-01-26 18:05:50 +0100 | [diff] [blame] | 307 | |
| 308 | cleanup: |
| 309 | ecp_point_free( &R ); ecp_point_free( &P ); |
| 310 | mpi_free( &e ); mpi_free( &s_inv ); mpi_free( &u1 ); mpi_free( &u2 ); |
| 311 | |
| 312 | return( ret ); |
| 313 | } |
| 314 | |
Manuel Pégourié-Gonnard | 7c8934e | 2013-06-27 12:54:02 +0200 | [diff] [blame] | 315 | /* |
Manuel Pégourié-Gonnard | b694b48 | 2013-08-08 13:30:57 +0200 | [diff] [blame] | 316 | * RFC 4492 page 20: |
| 317 | * |
| 318 | * Ecdsa-Sig-Value ::= SEQUENCE { |
| 319 | * r INTEGER, |
| 320 | * s INTEGER |
| 321 | * } |
| 322 | * |
| 323 | * Size is at most |
| 324 | * 1 (tag) + 1 (len) + 1 (initial 0) + ECP_MAX_BYTES for each of r and s, |
| 325 | * twice that + 1 (tag) + 2 (len) for the sequence |
| 326 | * (assuming ECP_MAX_BYTES is less than 126 for r and s, |
| 327 | * and less than 124 (total len <= 255) for the sequence) |
| 328 | */ |
| 329 | #if POLARSSL_ECP_MAX_BYTES > 124 |
| 330 | #error "POLARSSL_ECP_MAX_BYTES bigger than expected, please fix MAX_SIG_LEN" |
| 331 | #endif |
| 332 | #define MAX_SIG_LEN ( 3 + 2 * ( 2 + POLARSSL_ECP_MAX_BYTES ) ) |
| 333 | |
| 334 | /* |
Manuel Pégourié-Gonnard | 937340b | 2014-01-06 10:27:16 +0100 | [diff] [blame] | 335 | * Convert a signature (given by context) to ASN.1 |
Manuel Pégourié-Gonnard | b694b48 | 2013-08-08 13:30:57 +0200 | [diff] [blame] | 336 | */ |
Manuel Pégourié-Gonnard | 937340b | 2014-01-06 10:27:16 +0100 | [diff] [blame] | 337 | static int ecdsa_signature_to_asn1( ecdsa_context *ctx, |
| 338 | unsigned char *sig, size_t *slen ) |
Manuel Pégourié-Gonnard | b694b48 | 2013-08-08 13:30:57 +0200 | [diff] [blame] | 339 | { |
| 340 | int ret; |
Manuel Pégourié-Gonnard | 4cf0686 | 2013-09-16 12:07:45 +0200 | [diff] [blame] | 341 | unsigned char buf[MAX_SIG_LEN]; |
| 342 | unsigned char *p = buf + sizeof( buf ); |
Manuel Pégourié-Gonnard | b694b48 | 2013-08-08 13:30:57 +0200 | [diff] [blame] | 343 | size_t len = 0; |
| 344 | |
Manuel Pégourié-Gonnard | b694b48 | 2013-08-08 13:30:57 +0200 | [diff] [blame] | 345 | ASN1_CHK_ADD( len, asn1_write_mpi( &p, buf, &ctx->s ) ); |
| 346 | ASN1_CHK_ADD( len, asn1_write_mpi( &p, buf, &ctx->r ) ); |
| 347 | |
| 348 | ASN1_CHK_ADD( len, asn1_write_len( &p, buf, len ) ); |
| 349 | ASN1_CHK_ADD( len, asn1_write_tag( &p, buf, |
| 350 | ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ); |
| 351 | |
| 352 | memcpy( sig, p, len ); |
| 353 | *slen = len; |
| 354 | |
| 355 | return( 0 ); |
| 356 | } |
| 357 | |
| 358 | /* |
Manuel Pégourié-Gonnard | 937340b | 2014-01-06 10:27:16 +0100 | [diff] [blame] | 359 | * Compute and write signature |
| 360 | */ |
| 361 | int ecdsa_write_signature( ecdsa_context *ctx, |
| 362 | const unsigned char *hash, size_t hlen, |
| 363 | unsigned char *sig, size_t *slen, |
| 364 | int (*f_rng)(void *, unsigned char *, size_t), |
| 365 | void *p_rng ) |
| 366 | { |
| 367 | int ret; |
| 368 | |
| 369 | if( ( ret = ecdsa_sign( &ctx->grp, &ctx->r, &ctx->s, &ctx->d, |
| 370 | hash, hlen, f_rng, p_rng ) ) != 0 ) |
| 371 | { |
| 372 | return( ret ); |
| 373 | } |
| 374 | |
| 375 | return( ecdsa_signature_to_asn1( ctx, sig, slen ) ); |
| 376 | } |
| 377 | |
Paul Bakker | 9f3c7d7 | 2014-01-23 16:11:14 +0100 | [diff] [blame] | 378 | #if defined(POLARSSL_ECDSA_DETERMINISTIC) |
Manuel Pégourié-Gonnard | 937340b | 2014-01-06 10:27:16 +0100 | [diff] [blame] | 379 | /* |
| 380 | * Compute and write signature deterministically |
| 381 | */ |
| 382 | int ecdsa_write_signature_det( ecdsa_context *ctx, |
| 383 | const unsigned char *hash, size_t hlen, |
| 384 | unsigned char *sig, size_t *slen, |
| 385 | md_type_t md_alg ) |
| 386 | { |
| 387 | int ret; |
| 388 | |
| 389 | if( ( ret = ecdsa_sign_det( &ctx->grp, &ctx->r, &ctx->s, &ctx->d, |
| 390 | hash, hlen, md_alg ) ) != 0 ) |
| 391 | { |
| 392 | return( ret ); |
| 393 | } |
| 394 | |
| 395 | return( ecdsa_signature_to_asn1( ctx, sig, slen ) ); |
| 396 | } |
Paul Bakker | 9f3c7d7 | 2014-01-23 16:11:14 +0100 | [diff] [blame] | 397 | #endif /* POLARSSL_ECDSA_DETERMINISTIC */ |
Manuel Pégourié-Gonnard | 937340b | 2014-01-06 10:27:16 +0100 | [diff] [blame] | 398 | |
| 399 | /* |
Manuel Pégourié-Gonnard | b694b48 | 2013-08-08 13:30:57 +0200 | [diff] [blame] | 400 | * Read and check signature |
| 401 | */ |
| 402 | int ecdsa_read_signature( ecdsa_context *ctx, |
| 403 | const unsigned char *hash, size_t hlen, |
| 404 | const unsigned char *sig, size_t slen ) |
| 405 | { |
| 406 | int ret; |
| 407 | unsigned char *p = (unsigned char *) sig; |
| 408 | const unsigned char *end = sig + slen; |
| 409 | size_t len; |
| 410 | |
| 411 | if( ( ret = asn1_get_tag( &p, end, &len, |
| 412 | ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 ) |
| 413 | { |
| 414 | return( POLARSSL_ERR_ECP_BAD_INPUT_DATA + ret ); |
| 415 | } |
| 416 | |
| 417 | if( p + len != end ) |
| 418 | return( POLARSSL_ERR_ECP_BAD_INPUT_DATA + |
| 419 | POLARSSL_ERR_ASN1_LENGTH_MISMATCH ); |
| 420 | |
| 421 | if( ( ret = asn1_get_mpi( &p, end, &ctx->r ) ) != 0 || |
| 422 | ( ret = asn1_get_mpi( &p, end, &ctx->s ) ) != 0 ) |
| 423 | return( POLARSSL_ERR_ECP_BAD_INPUT_DATA + ret ); |
| 424 | |
| 425 | if( p != end ) |
| 426 | return( POLARSSL_ERR_ECP_BAD_INPUT_DATA + |
| 427 | POLARSSL_ERR_ASN1_LENGTH_MISMATCH ); |
| 428 | |
| 429 | return( ecdsa_verify( &ctx->grp, hash, hlen, &ctx->Q, &ctx->r, &ctx->s ) ); |
| 430 | } |
| 431 | |
| 432 | /* |
Manuel Pégourié-Gonnard | 8eebd01 | 2013-08-09 16:21:34 +0200 | [diff] [blame] | 433 | * Generate key pair |
| 434 | */ |
| 435 | int ecdsa_genkey( ecdsa_context *ctx, ecp_group_id gid, |
| 436 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ) |
| 437 | { |
| 438 | return( ecp_use_known_dp( &ctx->grp, gid ) || |
| 439 | ecp_gen_keypair( &ctx->grp, &ctx->d, &ctx->Q, f_rng, p_rng ) ); |
| 440 | } |
| 441 | |
Manuel Pégourié-Gonnard | f499993 | 2013-08-12 17:02:59 +0200 | [diff] [blame] | 442 | /* |
| 443 | * Set context from an ecp_keypair |
| 444 | */ |
| 445 | int ecdsa_from_keypair( ecdsa_context *ctx, const ecp_keypair *key ) |
| 446 | { |
Manuel Pégourié-Gonnard | 1001e32 | 2013-10-27 14:53:48 +0100 | [diff] [blame] | 447 | int ret; |
Manuel Pégourié-Gonnard | f499993 | 2013-08-12 17:02:59 +0200 | [diff] [blame] | 448 | |
Manuel Pégourié-Gonnard | 1001e32 | 2013-10-27 14:53:48 +0100 | [diff] [blame] | 449 | if( ( ret = ecp_group_copy( &ctx->grp, &key->grp ) ) != 0 || |
| 450 | ( ret = mpi_copy( &ctx->d, &key->d ) ) != 0 || |
| 451 | ( ret = ecp_copy( &ctx->Q, &key->Q ) ) != 0 ) |
| 452 | { |
Manuel Pégourié-Gonnard | f499993 | 2013-08-12 17:02:59 +0200 | [diff] [blame] | 453 | ecdsa_free( ctx ); |
Manuel Pégourié-Gonnard | 1001e32 | 2013-10-27 14:53:48 +0100 | [diff] [blame] | 454 | } |
Manuel Pégourié-Gonnard | f499993 | 2013-08-12 17:02:59 +0200 | [diff] [blame] | 455 | |
| 456 | return( ret ); |
| 457 | } |
Manuel Pégourié-Gonnard | 8eebd01 | 2013-08-09 16:21:34 +0200 | [diff] [blame] | 458 | |
| 459 | /* |
Manuel Pégourié-Gonnard | 7c8934e | 2013-06-27 12:54:02 +0200 | [diff] [blame] | 460 | * Initialize context |
| 461 | */ |
| 462 | void ecdsa_init( ecdsa_context *ctx ) |
| 463 | { |
| 464 | ecp_group_init( &ctx->grp ); |
| 465 | mpi_init( &ctx->d ); |
| 466 | ecp_point_init( &ctx->Q ); |
| 467 | mpi_init( &ctx->r ); |
| 468 | mpi_init( &ctx->s ); |
Manuel Pégourié-Gonnard | 7c8934e | 2013-06-27 12:54:02 +0200 | [diff] [blame] | 469 | } |
| 470 | |
| 471 | /* |
| 472 | * Free context |
| 473 | */ |
| 474 | void ecdsa_free( ecdsa_context *ctx ) |
| 475 | { |
| 476 | ecp_group_free( &ctx->grp ); |
| 477 | mpi_free( &ctx->d ); |
| 478 | ecp_point_free( &ctx->Q ); |
| 479 | mpi_free( &ctx->r ); |
| 480 | mpi_free( &ctx->s ); |
Manuel Pégourié-Gonnard | 7c8934e | 2013-06-27 12:54:02 +0200 | [diff] [blame] | 481 | } |
Manuel Pégourié-Gonnard | 3aeb5a7 | 2013-01-26 18:05:50 +0100 | [diff] [blame] | 482 | |
Manuel Pégourié-Gonnard | 2aea141 | 2013-01-26 16:33:44 +0100 | [diff] [blame] | 483 | #if defined(POLARSSL_SELF_TEST) |
| 484 | |
| 485 | /* |
| 486 | * Checkup routine |
| 487 | */ |
| 488 | int ecdsa_self_test( int verbose ) |
| 489 | { |
Manuel Pégourié-Gonnard | 7c59363 | 2014-01-20 10:27:13 +0100 | [diff] [blame] | 490 | ((void) verbose ); |
| 491 | return( 0 ); |
Manuel Pégourié-Gonnard | 2aea141 | 2013-01-26 16:33:44 +0100 | [diff] [blame] | 492 | } |
| 493 | |
| 494 | #endif |
| 495 | |
| 496 | #endif /* defined(POLARSSL_ECDSA_C) */ |